Alertas de Seguridad de la Información

M Alto vulnerabilidad

25/06/2026

[CVE-2026-54838] Subscriber SQL Injection in WC Vendors Marketplace <= 2.6.8 versions.

Subscriber SQL Injection in WC Vendors Marketplace

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

25/06/2026

[CVE-2026-54822] Subscriber SQL Injection in SALESmanago & Leadoo <= 3.11.2 versions.

Subscriber SQL Injection in SALESmanago & Leadoo

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

25/06/2026

[CVE-2026-12937] The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin plugin for Word…

The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin plugin for WordPress is vulnerable to generic SQL Injection via the 'post_id' parameter in all versions up to, and including, 2.22.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to appe…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

25/06/2026

[CVE-2026-12077] The Dokan Pro plugin for WordPress is vulnerable to time-based SQL Injection via the via 'latitude' …

The Dokan Pro plugin for WordPress is vulnerable to time-based SQL Injection via the via 'latitude' and 'longitude' parameters in all versions up to, and including, 5.0.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existin…

nvdaltovulnerabilidad CVSS 7.5 NVD

Q Alto vulnerabilidad

25/06/2026

[CVE-2026-9781] Quest NetVault Backup NVBURASDevice SQL Injection Remote Code Execution Vulnerability. This vulnerab…

Quest NetVault Backup NVBURASDevice SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the processing of NVBURASDevice JSON-…

nvdaltovulnerabilidad CVSS 8.8 NVD

Q Alto vulnerabilidad

25/06/2026

[CVE-2026-9782] Quest NetVault Backup NVBUDeviceDrive SQL Injection Remote Code Execution Vulnerability. This vulner…

Quest NetVault Backup NVBUDeviceDrive SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the processing of NVBUDeviceDrive J…

nvdaltovulnerabilidad CVSS 8.8 NVD

Q Alto vulnerabilidad

25/06/2026

[CVE-2026-9783] Quest NetVault Backup NVBURemovableMedia SQL Injection Remote Code Execution Vulnerability. This vul…

Quest NetVault Backup NVBURemovableMedia SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the processing of NVBURemovableM…

nvdaltovulnerabilidad CVSS 8.8 NVD

Q Alto vulnerabilidad

25/06/2026

[CVE-2026-9784] Quest NetVault Backup NVBULibraryPort SQL Injection Remote Code Execution Vulnerability. This vulner…

Quest NetVault Backup NVBULibraryPort SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the processing of NVBULibraryPort J…

nvdaltovulnerabilidad CVSS 8.8 NVD

Q Alto vulnerabilidad

25/06/2026

[CVE-2026-9785] Quest NetVault Backup NVBULibrarySlot SQL Injection Remote Code Execution Vulnerability. This vulner…

Quest NetVault Backup NVBULibrarySlot SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the processing of NVBULibrarySlot J…

nvdaltovulnerabilidad CVSS 8.8 NVD

Q Alto vulnerabilidad

25/06/2026

[CVE-2026-9786] Quest NetVault Backup NVBUDashboard SQL Injection Remote Code Execution Vulnerability. This vulnerab…

Quest NetVault Backup NVBUDashboard SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the processing of NVBUDashboard JSON-…

nvdaltovulnerabilidad CVSS 8.8 NVD

C Alto vulnerabilidad

25/06/2026

[CVE-2026-39951] Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have a…

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have a Stored SQL Injection vulnerability through graph_name_regexp in the Reports feature. This issue has been fixed in version 1.2.31.

nvdaltovulnerabilidad CVSS 7.6 NVD

Q Alto vulnerabilidad

25/06/2026

[CVE-2026-7570] Quest NetVault Backup NVBUDashboard SQL Injection Remote Code Execution Vulnerability. This vulnerab…

Quest NetVault Backup NVBUDashboard SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the processing of NVBUDashboard JSON-…

nvdaltovulnerabilidad CVSS 8.8 NVD

N Alto vulnerabilidad

24/06/2026

[CVE-2026-56351] n8n before version 2.4.0 contains a sql injection vulnerability in MySQL, PostgreSQL, and Microsoft …

n8n before version 2.4.0 contains a sql injection vulnerability in MySQL, PostgreSQL, and Microsoft SQL nodes that allows authenticated users to inject arbitrary SQL through unescaped identifier values in node configuration parameters. Attackers with workflow creation permissions can supply specially crafted table or column names to execute unauthorized database commands and compromise data integr…

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-56052] Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i…

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in FunnelKit Funnel Builder by FunnelKit allows Blind SQL Injection. This issue affects Funnel Builder by FunnelKit: from n/a through 3.15.0.5.

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-9179] The WP Forms Connector plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter…

The WP Forms Connector plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the /wp-json/wp/v3/post/list REST endpoint in versions up to and including 1.8. This is due to insufficient escaping on the user-supplied 'order' parameter (read directly from $_GET['order'] into $shorting) and the lack of sufficient preparation on the existing SQL query in the listPost() functi…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-8705] The ClearSale Total plugin for WordPress is vulnerable to SQL Injection via the `pagseguro[metodo]` …

The ClearSale Total plugin for WordPress is vulnerable to SQL Injection via the `pagseguro[metodo]` POST parameter of the `clearsale_total_push` AJAX action in all versions up to, and including, 3.4.2. The handler is registered for unauthenticated users (`wp_ajax_nopriv_clearsale_total_push`), and although a `wp_verify_nonce()` check exists, the failing branch's `die()` is commented out so executi…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

23/06/2026

[CVE-2025-61024] An issue in the sqlo_try_in_loop component of openlink virtuoso-opensource v7.2.11 allows attackers …

An issue in the sqlo_try_in_loop component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

23/06/2026

[CVE-2025-61029] An issue in the sqlo_untry component of openlink virtuoso-opensource v7.2.11 allows attackers to cau…

An issue in the sqlo_untry component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

23/06/2026

[CVE-2026-34914] A missing sanitisation of user input in the zone-include.php script of Revive Adserver 6.0.6 and ear…

A missing sanitisation of user input in the zone-include.php script of Revive Adserver 6.0.6 and earlier. A low‑privileged user could exploit the clientid parameter to perform blind SQL injection attacks. Input sanitisation has been improved to ensure that all parameters processed by the script are properly validated.

nvdaltovulnerabilidad CVSS 8.3 NVD

M Alto vulnerabilidad

23/06/2026

[CVE-2025-61020] An issue in the sqlo_strip_in_join component of openlink virtuoso-opensource v7.2.11 allows attacker…

An issue in the sqlo_strip_in_join component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.

nvdaltovulnerabilidad CVSS 7.5 NVD